CVE-2025-67280: Tim-Solutions Tim Flow

Medium severity, CVSS 5.4. EPSS: 0.2% chance of exploitation in the next 30 days.

In TIM BPM Suite/ TIM FLOW through 9.1.2 multiple Hibernate Query Language injection vulnerabilities exist which allow a low privileged user to extract passwords of other users and access sensitive data of another user.

Affected products

• Tim-Solutions Tim Flow: before 9.1.2 (fixed in 9.1.2)

Published 2026-01-09. Last modified 2026-06-17.